docker-compose.dev.yml

services:
  opentaberna-api:
    build:
      context: .
      dockerfile: src/Dockerfile
    image: opentaberna-api:latest
    command: uvicorn app.main:app --host 0.0.0.0 --port 8000
    env_file: .env
    environment:
      REDIS_URL: redis://opentaberna-redis:6379/0
      KEYCLOAK_URL: http://opentaberna-keycloak:8080
      KEYCLOAK_PUBLIC_URL: http://localhost:8080
      STORAGE_ENDPOINT_URL: http://opentaberna-garage:3900
      OTEL_EXPORTER_OTLP_ENDPOINT: http://opentaberna-otel-collector:4318
      OTEL_SERVICE_NAME: opentaberna-api
      PAPERLESS_URL: http://opentaberna-paperless:8000
    volumes:
      - stripe_webhook_secret:/run/secrets:ro
    ports:
      - "8000:8000"
    restart: unless-stopped
    container_name: opentaberna-api
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/docs', timeout=5)\""]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 20s
    depends_on:
      opentaberna-db:
        condition: service_started
      opentaberna-redis:
        condition: service_started
      opentaberna-keycloak:
        condition: service_started
      opentaberna-garage:
        condition: service_started
      opentaberna-stripe-listener:
        condition: service_started
      opentaberna-paperless:
        condition: service_healthy

  opentaberna-stripe-listener:
    build:
      context: .
      dockerfile: src/docker/stripe-listener/Dockerfile
    image: opentaberna-stripe-listener:latest
    env_file: .env
    volumes:
      - stripe_webhook_secret:/run/secrets
    restart: unless-stopped
    container_name: opentaberna-stripe-listener
    healthcheck:
      test: ["CMD-SHELL", "test -s /run/secrets/stripe_webhook_secret"]
      interval: 2s
      timeout: 2s
      retries: 15
      start_period: 5s

  opentaberna-db:
    image: postgres:17-alpine
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-opentaberna_password}
      POSTGRES_DB: ${POSTGRES_DB:-opentaberna}
      POSTGRES_USER: ${POSTGRES_USER:-opentaberna}
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    container_name: opentaberna-db
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-opentaberna} -d ${POSTGRES_DB:-opentaberna}"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s
    ports:
      - "5432:5432"

  opentaberna-redis:
    image: redis:8-alpine
    command: redis-server --appendonly yes
    volumes:
      - ./redis_data:/data
    restart: unless-stopped
    container_name: opentaberna-redis
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s
    ports:
      - "6379:6379"

  opentaberna-keycloak:
    image: quay.io/keycloak/keycloak:26.2
    # The master realm defaults to sslRequired=external, and Docker's port
    # forwarding makes a request from the host look non-local, so Keycloak
    # refuses plain HTTP and the admin console becomes unreachable. Relaxing it
    # once the server is up keeps http://localhost:8080/admin usable.
    #
    # Applied on every start rather than once by hand, because it lives in the
    # database and would be lost whenever the keycloak_data volume is recreated.
    # Development only - the compose file that ships this is the dev one.
    command:
      - "-c"
      - |
        /opt/keycloak/bin/kc.sh start-dev --import-realm &
        server=$$!
        for _ in $$(seq 1 60); do
          if /opt/keycloak/bin/kcadm.sh config credentials \
               --server http://127.0.0.1:8080 --realm master \
               --user "$$KEYCLOAK_ADMIN" --password "$$KEYCLOAK_ADMIN_PASSWORD" \
               >/dev/null 2>&1; then
            /opt/keycloak/bin/kcadm.sh update realms/master -s sslRequired=NONE >/dev/null 2>&1 \
              && echo "master realm: sslRequired=NONE (dev)"
            break
          fi
          sleep 2
        done
        wait $$server
    entrypoint: ["/bin/bash"]
    environment:
      KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
      KC_HTTP_PORT: 8080
      # Exposes /health on the management port (9000). Without this the
      # healthcheck below has nothing to probe.
      KC_HEALTH_ENABLED: "true"
    volumes:
      # Named volume so registered users, their attributes and role grants
      # survive a container recreate. Without it Keycloak's dev H2 database
      # lives only inside the container, every user is regenerated with a new
      # sub, and profiles already linked to the old sub break.
      - keycloak_data:/opt/keycloak/data
      - ./keycloak:/opt/keycloak/data/import:ro
    ports:
      - "8080:8080"
    restart: unless-stopped
    container_name: opentaberna-keycloak
    healthcheck:
      # The Keycloak image ships neither curl nor wget, so the previous
      # curl-based check could never pass and the container sat "unhealthy"
      # even when serving fine. bash is present, so use its /dev/tcp support
      # against the management port.
      test:
        [
          "CMD-SHELL",
          "exec 3<>/dev/tcp/127.0.0.1/9000 && printf 'GET /health/ready HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n' >&3 && grep -q '\"UP\"' <&3",
        ]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 60s

  opentaberna-garage:
    image: dxflrs/garage:v2.4.1
    # --single-node lays out a one-node cluster and --default-access-key creates
    # the API's key on start, so the store needs no manual setup. The API
    # creates its buckets itself.
    command: /garage server --single-node --default-access-key
    environment:
      GARAGE_RPC_SECRET: ${GARAGE_RPC_SECRET:?set GARAGE_RPC_SECRET in .env, generate one with openssl rand -hex 32}
      GARAGE_DEFAULT_ACCESS_KEY: ${STORAGE_ACCESS_KEY:-opentaberna}
      GARAGE_DEFAULT_SECRET_KEY: ${STORAGE_SECRET_KEY:-opentaberna_secret}
    volumes:
      - ./docker/garage/garage.toml:/etc/garage.toml:ro
      - ./garage_data:/var/lib/garage
    ports:
      - "9000:3900"   # S3 API
      - "3903:3903"   # Admin API (GET /health)
    restart: unless-stopped
    container_name: opentaberna-garage
    healthcheck:
      test: ["CMD", "/garage", "status"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 10s

  opentaberna-worker:
    build:
      context: .
      dockerfile: src/Dockerfile
    image: opentaberna-worker:latest
    command: python -m app.worker_main app.worker.WorkerSettings
    env_file: .env
    environment:
      REDIS_URL: redis://opentaberna-redis:6379/0
      STORAGE_ENDPOINT_URL: http://opentaberna-garage:3900
      OTEL_EXPORTER_OTLP_ENDPOINT: http://opentaberna-otel-collector:4318
      OTEL_SERVICE_NAME: opentaberna-worker
    restart: unless-stopped
    container_name: opentaberna-worker
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import os,redis; redis.Redis(host=os.getenv('REDIS_HOST', 'opentaberna-redis'), port=int(os.getenv('REDIS_PORT', 6379))).ping()\""]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 20s
    depends_on:
      opentaberna-db:
        condition: service_healthy
      opentaberna-redis:
        condition: service_healthy
      opentaberna-garage:
        condition: service_healthy

  opentaberna-mail:
    image: greenmail/standalone:2.1.3
    environment:
      GREENMAIL_OPTS: >-
        -Dgreenmail.setup.test.all
        -Dgreenmail.hostname=0.0.0.0
        -Dgreenmail.users=admin:admin@example.com
    ports:
      - "3025:3025" # SMTP
      - "3143:3143" # IMAP
      - "8081:8080" # GreenMail web UI
    restart: unless-stopped

  opentaberna-paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.15
    environment:
      PAPERLESS_REDIS: redis://opentaberna-paperless-redis:6379
      PAPERLESS_DBHOST: opentaberna-paperless-db
      PAPERLESS_DBNAME: paperless
      PAPERLESS_DBUSER: paperless
      PAPERLESS_DBPASS: ${PAPERLESS_DB_PASSWORD:-paperless}
      PAPERLESS_TIME_ZONE: Europe/Berlin
      PAPERLESS_URL: http://localhost:8010
      PAPERLESS_SECRET_KEY: ${PAPERLESS_SECRET_KEY:-change-me-in-development}
      PAPERLESS_ADMIN_USER: ${PAPERLESS_ADMIN_USER:-admin}
      PAPERLESS_ADMIN_PASSWORD: ${PAPERLESS_ADMIN_PASSWORD:-admin}
    volumes:
      - paperless_data:/usr/src/paperless/data
      - paperless_media:/usr/src/paperless/media
      - paperless_consume:/usr/src/paperless/consume
    ports:
      - "8010:8000"
    restart: unless-stopped
    healthcheck:
      # /api/status requires a token; use the public login page for liveness.
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/accounts/login/"]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 60s
    depends_on:
      opentaberna-paperless-db:
        condition: service_healthy
      opentaberna-paperless-redis:
        condition: service_healthy

  opentaberna-paperless-db:
    image: postgres:17-alpine
    environment:
      POSTGRES_DB: paperless
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: ${PAPERLESS_DB_PASSWORD:-paperless}
    volumes:
      - paperless_postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U paperless -d paperless"]
      interval: 10s
      timeout: 5s
      retries: 5

  opentaberna-paperless-redis:
    image: redis:8-alpine
    volumes:
      - paperless_redis_data:/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # --------------------------------------------------------------------
  # Observability (S3). Self-hosted by default; the collector is the seam,
  # so pointing OTEL_EXPORTER_OTLP_ENDPOINT at a vendor replaces all three
  # without touching application code.
  # --------------------------------------------------------------------

  opentaberna-otel-collector:
    image: otel/opentelemetry-collector-contrib:0.116.1
    command: ["--config=/etc/otel/config.yaml"]
    volumes:
      - ./src/docker/observability/otel-collector.yaml:/etc/otel/config.yaml:ro
    ports:
      - "4318:4318"   # OTLP/HTTP
      - "8889:8889"   # Prometheus scrape target
    restart: unless-stopped
    container_name: opentaberna-otel-collector

  opentaberna-prometheus:
    image: prom/prometheus:v3.1.0
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.retention.time=15d"
    volumes:
      - ./src/docker/observability/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus_data:/prometheus
    ports:
      - "9090:9090"
    restart: unless-stopped
    container_name: opentaberna-prometheus
    depends_on:
      - opentaberna-otel-collector

  opentaberna-grafana:
    image: grafana/grafana:11.4.0
    environment:
      # Development only. The dashboard is read-only and carries no secrets,
      # and requiring a login to look at a latency graph on your own laptop
      # helps nobody.
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: Admin
      GF_AUTH_DISABLE_LOGIN_FORM: "true"
      GF_USERS_DEFAULT_THEME: light
    volumes:
      - ./src/docker/observability/grafana/datasources:/etc/grafana/provisioning/datasources:ro
      - ./src/docker/observability/grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
      - grafana_data:/var/lib/grafana
    ports:
      - "3001:3000"
    restart: unless-stopped
    container_name: opentaberna-grafana
    depends_on:
      - opentaberna-prometheus

volumes:
  keycloak_data:
  stripe_webhook_secret:
  prometheus_data:
  grafana_data:
  paperless_data:
  paperless_media:
  paperless_consume:
  paperless_postgres_data:
  paperless_redis_data: